Cybersecurity due diligence checks what a target exposes to the internet before a sponsor commits: internet-facing endpoints, certificates and security headers. Before authorization, Meo Advisors reads that exposure from passive public sources only, with no scans and no access to the target’s systems. Penetration testing runs only on request, with written authorization.
In short
- External exposure review, internet-facing endpoints, certificates and security headers, read from passive public sources before authorization.
- Penetration testing only on request, with authorization.
- Findings go into the prioritized risk register and the hardening rows of the 100-day plan.
What is due diligence in cyber security?
Cybersecurity due diligence is the deal-stage review of what a target exposes to attackers, and of what would have to change after close. It answers whether a security problem could change the price, the terms or the first 100 days.
An external attack surface is everything a company exposes to the internet that an attacker could reach.
Authorized testing is penetration testing and any check inside the target’s systems; it needs authorized access and runs only on request.
Cybersecurity is one of the six areas of private equity due diligence.
- 01Marketing & Digital VisibilityCan customers find the target in search, maps and AI answers?
- 02CompetitionWhich peers win the target’s customers, and how?
- 03CX & Call CentersWhat happens when a customer calls, texts or fills in a form?
- 04CybersecurityWhat can an attacker see from the internet?
- 05Technology & InfrastructureWhat does it run on, and where is the technical debt?
- 06Compliance & RiskWhere do consent, privacy or accessibility rules create exposure?
What can be seen of a target from public sources?
From public sources: internet-facing endpoints, certificates, security headers and the systems a target runs in public. Before authorization, we read what those show from passive sources.
| Layer | What we check |
|---|---|
| Marketing & Digital Visibility | AI answers and search ranking; Listings and reviews; Paid media; Pricing |
| Technology & Infrastructure | Technical debt; Vendors and SaaS subscriptions; Tags and measurement; Page speed |
| Cybersecurity | External exposure review; Internet-facing endpoints; Certificates and security headers; Penetration testing on request, with authorization |
| Visible from outside | Needs authorized access |
|---|---|
| External exposure review | Penetration testing on request, with authorization |
| Internet-facing endpoints | |
| Certificates and security headers |
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
Use the cybersecurity due diligence checklist to separate passive evidence from checks that need written authorization.
What is a red flag due diligence report?
A short report of the findings that could change price or terms, each with its evidence and an owner. In cybersecurity, it is the top of the prioritized risk register.
| Risk | Likelihood | Impact | Owner |
|---|---|---|---|
| Lead-form consent wording | High | High | Marketing lead |
| Exposed admin login | Medium | High | IT lead |
- Exposed admin logins and services that should not face the internet.
- Expired or misconfigured certificates and missing security headers.
- Shared templates that repeat the same weakness on every site built from them.
What are types of due diligence?
Cybersecurity diligence sits beside technology, IT and compliance diligence. They overlap, but each answers a different question.
| Type | Question it answers | Needs access? |
|---|---|---|
| Cybersecurity | What does the target expose, and how exploitable is it? | Passive review: no. Testing: yes, with written authorization |
| Technology | What does it run on, and where is the technical debt? | Outside view first; internals need access |
| IT | Can the infrastructure support the plan? | Mostly yes |
| Compliance | Where do consent, privacy or accessibility rules create exposure? | Public pages first; policies need access |
What is the difference between due care and due diligence?
Due diligence is checking before you commit; due care is maintaining reasonable controls afterwards. In our work, diligence finds the exposure and the hardening rows of the 100-day plan are the due care.
| Plan row | Days 0–30 | Days 31–60 | Days 61–100 |
|---|---|---|---|
| Hardening | |||
| Technology and security | Close exposed services | Fix shared templates | Retire duplicate tools |
The hardening rows sit beside value creation in the 100-day value creation and hardening plan.
Why does cyber exposure matter more in healthcare deals?
Because breaches cost healthcare companies more than any other industry, and patient data raises the regulatory stakes.
For healthcare targets, see healthcare due diligence.
Does cyber due diligence need access to the target’s systems?
Not for the passive external review. Yes for scans, penetration testing and internal checks, which run only on request with written authorization.
We agree the scope and the authorization in writing before any active test, and we list each question the outside view cannot answer with the access that would.
What you receive from cybersecurity due diligence
Ranked risks with evidence and owners, and the hardening work that closes them.
What we deliver
High-priority Risk Matrices & Competitive Gap Analyses.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.